TOTP
Time-based one-time password
An authenticator app computes a short code with HMAC from a shared secret and the current 30-second time step. It proves possession of the secret but can be phished in real time, so servers must rate-limit attempts and reject a code that was already used.
- Defined in
- RFC 6238
Covered in
Guide
Stop account takeover with the right MFA and login defenses
Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.
Guide
Passkeys and MFA: WebAuthn enrollment, sign-in and replacement
Register, verify and replace passkeys with WebAuthn so phishing resistance survives the account’s whole lifecycle, and map passkeys and other MFA methods to the NIST SP 800-63B-4 assurance levels.